Excessive Security Log Events - Event ID 5379 - Windows 10

I have seen MANY posts on this forum, about this specific issue (excessive 5379 events), and many other EVENT ID's. as well. These are actually "audit success" events, and NOT errors, and as Ed Tittel has stated, this stuff (and telemetry) started way back from the Vista OS days.

Even a freshly installed Windows 10 machine, with NOTHING extra added, will start logging MANY 5379 and related events, especially if using a Microsoft email based account, rather than a local account (some error events too).  This is because there are several "internal" special admin accounts in the OS to "get stuff done".

Actually the error events (not the 5379 etc) are what most of the unscrupulous scammers rely on to "scare" dumb users into paying a fee to "fix" their computers, because of "serious errors", when they log in remotely, take over the machine, and run Event Viewer for them to see. These are just "normal" of course, mainly because like 99% of commercial software, it is not perfect, and the hundreds of thousands of different PC configurations that users have cannot be perfectly matched to perfect drivers working perfectly!

So, because you see "thousands of event entries" or a few hundred errors or warnings, DON'T make the knee-jerk reaction that many do, that it is the "magic bullet" that points to the cause of whatever problem you are chasing. it is RARELY the case, and will most times send you on a "wild goose chase"!

Instead, do a proper, logical approach to fault-finding your issue.

First, try to define the problem. Is it random, or reproducible with a set of known actions.  If reproducible, write down the sequence of events that cause the issue, and document, cut/paste or screen-shot any error messages, in the order they occur.

Try to remember the date when the issue first started to occur, and track any changes, new software, new devices, or new updates that occurred close to that time. Did you update a driver around that time?

If any "apps" are crashing, download the Nirsoft APPCRASHVIEW WER Viewer program to check them out, to give possible clues to your issue.

Make good use of the Task manager to check high CPU and memory (one looping core at 100% will show as 25% on a 4-core CPU). Add extra info columns to check for increasing memory use (memory leaks). Go to APPS settings and turn off background apps that do not need to run in background.

If the issue is intermittent and random, it will be more difficult to pin down, BUT if you go back to basics, and eliminate some obvious items that many forget, it may move you forward. For instance, when did you last monitor your CPU or Motherboard, or Graphics adapter temperatures? Did you check the SMART/Health status of your HDD/SSD disks? Are all your fans working, and not clogged. Is your PSU delivering enough power for your internal add-in cards etc? Food for thought

So this is a ridiculous issue.  If I was a hacker trying to cover my tracks, I would flood event logs with garbage like this.  Why doesn't Microsoft provide more details so that we can know the process generating these logs.  Why is it so hard to figure out what's going on here.

In my case, I get 50+ per minute and I cannot find bad activity because the log is flushed.  This issue should be raised as a security concern especially since the it involves the Security event logs.  

A tool that allows us to pinpoint the cause would alleviate the need for us to guesstimate the cause.  Does anyone know if tools like procmon.exe would help in identifying the process causing this issue? 

Note, I've checked my GPO and no Audit Policy settings are set; leading me to believe that a rogue process is logging them.

I am facing the same issue. However Windows does not crash. It is just does nothing for 1-4 seconds. It is even impossible to move the mouse pointer. This happens roughly every 15 minutes.  I am using Microsoft Windows Home Version 1909 (Build 18363.778).

@RemoteComputerTechnician as you have posted several "solutions" on here, that have only turned out to NOT change the issue, I would respectfully suggest that you THOROUGHLY test any and ALL changes that you try, for at least 1 to 2 weeks, before posting them on here, as it may cause confusion, and if users try these, it might cause them issues if they no not have the proper skills to do it properly, and be unable to revert a bad change.

As I have posted on here a few times, these 5379 Audit Success event logs are a NORMAL part of the Microsoft Security reporting "system", and do NOT signify a problem that any users need to fix, and there is NO PROBLEM with their hardware or software, and NO rogue processes running doing bad stuff.

Many enterprise users actually WANT auditing events, that is why they are there, HOWEVER, most regular users do NOT want this (as it can be excessive), and ideally, Microsoft should be providing a setting for Windows 10 Home and Pro users to be able to turn this OFF.

Maybe those who aggree with that, should be posting that suggestion in the Feedback Hub, and vote up any others who have done this.

For users getting freezes, and game-play lags, performance issues, should NOT look here for a solution, as these 5379 events have NOTHING to do with that.

It may well be the other well posted problem of long run times for the scheduled runs of WaasMedic and CompatTelrunner services.

RUN gpedit.msc

Local Computer configuration

\Administrative Templates

\Network

\Microsoft Peer-to-Peer Networking Services

\Peer Name Resolution Protocol

\Global Clouds

\Link-Local Clouds

\Site-Local Clouds

    (Under all 3 headers)   

Turn off Multicast Bootstrap    Enabled

    Set PNRP cloud to resolve only    Enabled   

    Turn off PNRP cloud creation    Enabled   

\Network\Microsoft Peer-to-Peer Networking Services

    Turn off Microsoft Peer-to-Peer Networking Services    Enabled   

\Network\Network Connections\Windows Defender Firewall\Domain Profile

    Windows Defender Firewall: Protect all network connections    Enabled   

\Network\Network Connections\Windows Defender Firewall\Standard Profile

    Windows Defender Firewall: Protect all network connections    Enabled

Forget the warnings